The flaw comes as a result of the Skype program failing to properly encode the incoming users' "Full Name" field, which means Javascript code can easily be placed in that field instead. The victim still receives a message from the attacking user, but with the name replaced by the first characters of the code string.

This flaw alone would not by itself cause an issue except that Skype also improperly allows the URI scheme used by the built-in WebKit browser in Skype to use the "file://" URL header, gaining access to the file system under Skype's own permissions, which includes access to the iOS contact list. In the video below, Phil demonstrates the delivery of a Base-64 encoded JavaScript file (which is then decoded by the attacker's server) and run to copy the device's contact list back to the attacking server (in SQLite format).

Apple's built-in iOS application sandboxing prevents the attack from going anywhere beyond those files that Skype has access to. Skype on iOS is set by default to only allow existing contacts to chat with a user, which would largely prevent the possibility of such an attack being seen "in the wild"; but if the "established contacts only" feature is turned off, it opens up the possibility of random chatters executing a malicious JavaScript on iOS devices. As the attack is executed over http, a firewall or blocking ports would not prevent the attack.

This new vulnerability echoes a similar problem found in May by security researcher Guy Maddern, who discovered a way to execute a malicious payload in chat mode using Skype for Mac computers (version 5.x). The company at the time said the issue, which allowed attackers the chance at gaining full privileges for the compromised machine, had been discovered and fixed by the time reports appeared on it.

comment title

That's the problem with any security, at some point you have to trust something (in this case Skypes access to your contacts) and that's where the vulnerabilities come in. Hopefully Skype will address the issue quickly.